ci(rest): proxy multi arch image (#2980)

* ci(rest-proxy): multi arch image

* ci(rest-proxy): fix doc

* ci(rest-proxy): add test build multi arch image

* ci(rest-proxy): update version

* ci(rest-proxy): fix missing setup buildx

* ci(rest-proxy): fix target

* ci(rest-proxy): fix trivy

* ci(rest-proxy): fix cache

* ci(rest-proxy): load true

* ci(rest-proxy): move image scan

* ci(rest-proxy): fix name

* ci(rest-proxy): fix cache

* ci(rest-proxy): add name

* ci(rest-proxy): add schedule scan

* ci(rest-proxy): fix string

* ci(rest-proxy): update cache version

.github/workflows/rest-proxy.yml

@@ -11,6 +11,8 @@ on:
     paths:
       - ".github/workflows/rest-proxy.yml"
       - "proxies/rest/**"
+  schedule:
+    - cron: "0 0 * * *"
 
 jobs:
   build:
@@ -18,6 +20,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
+      - name: Cache Docker layers
+        uses: actions/cache@v3
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-single-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-single-buildx
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v2
       - name: Set up Docker Buildx
@@ -30,30 +39,102 @@ jobs:
           context: proxies/rest
           target: runner
           outputs: type=docker,dest=/tmp/rest-proxy-image.tar
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+      - # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+        name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
       - name: Upload artifact
-        uses: actions/upload-artifact@v2
+        uses: actions/upload-artifact@v3
         with:
           name: rest-proxy-image
           path: /tmp/rest-proxy-image.tar
 
-  use:
+  image-scan:
+    name: Image scan
     runs-on: ubuntu-latest
     needs: build
     steps:
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v2
       - name: Download artifact
-        uses: actions/download-artifact@v2
+        uses: actions/download-artifact@v3
         with:
           name: rest-proxy-image
           path: /tmp
       - name: Load Docker image
         run: docker load --input /tmp/rest-proxy-image.tar
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        with:
+          image-ref: "discordeno/rest-proxy:latest"
+          format: "table"
+          exit-code: "0"
+          ignore-unfixed: true
+          vuln-type: "os,library"
+          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+      - name: Run Trivy vulnerability scanner
+        uses: aquasecurity/trivy-action@master
+        if: ${{ github.event_name == 'schedule' }}
+        with:
+          image-ref: "discordeno/rest-proxy:latest"
+          exit-code: "0"
+          vuln-type: "os,library"
+          severity: "UNKNOWN,LOW,MEDIUM,HIGH,CRITICAL"
+          format: "sarif"
+          output: "trivy-results.sarif"
+      - name: Upload Trivy scan results to GitHub Security tab
+        uses: github/codeql-action/upload-sarif@v2
+        if: ${{ github.event_name == 'schedule' }}
+        with:
+          sarif_file: "trivy-results.sarif"
+
+  build-all-arch:
+    name: Build image for all architectures
+    needs: build
+    if: ${{ github.event_name != 'schedule' }}
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v3
+      - name: Cache Docker layers
+        uses: actions/cache@v3
+        with:
+          path: /tmp/.buildx-cache
+          key: ${{ runner.os }}-single-buildx-${{ github.sha }}
+          restore-keys: |
+            ${{ runner.os }}-single-buildx
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
+      - name: Build Docker image
+        uses: docker/build-push-action@v4
+        with:
+          context: proxies/rest
+          push: false
+          tags: "discordeno/rest-proxy:latest"
+          # linux/s390x stuck at yarn install, remove it for now
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le
+          target: runner
+          cache-from: type=local,src=/tmp/.buildx-cache
+          cache-to: type=local,dest=/tmp/.buildx-cache-new,mode=max
+      - # Temp fix
+        # https://github.com/docker/build-push-action/issues/252
+        # https://github.com/moby/buildkit/issues/1896
+        name: Move cache
+        run: |
+          rm -rf /tmp/.buildx-cache
+          mv /tmp/.buildx-cache-new /tmp/.buildx-cache
 
   publish:
     name: Publish image
-    needs: use
-    if: ${{ github.ref == 'refs/heads/main' }}
+    needs: build-all-arch
+    if: ${{ github.ref == 'refs/heads/main' && github.event_name == 'push' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -62,14 +143,21 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v3
       - name: Log in to the Container registry
-        uses: docker/login-action@f054a8b539a109f9f41c372932f1ae047eff08c9
+        uses: docker/login-action@v2
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v2
       - name: Build and push Docker image
-        uses: docker/build-push-action@ad44023a93711e3deb337508980b4b5e9bcdc5dc
+        uses: docker/build-push-action@v4
         with:
           context: proxies/rest
           push: true
           tags: "ghcr.io/discordeno/rest-proxy:latest"
+          # linux/s390x stuck at yarn install, remove it for now
+          platforms: linux/amd64,linux/arm/v6,linux/arm/v7,linux/arm64/v8,linux/ppc64le
+          target: runner

proxies/rest/Dockerfile

@@ -5,15 +5,16 @@
 # prod-deps: contains only dependencies excluding dev dependencies
 # runner: the final image, with only the dependencies and compiled files
 
-FROM node:18.15.0-alpine3.17 AS deps
+# build only with the platform of the host machine, since it only uses for dev purposes
+FROM --platform=$BUILDPLATFORM node:18.15.0-alpine3.17 AS deps
 WORKDIR /app
 # copy necessary for install dependencies
 COPY package.json yarn.lock ./
 # install dependencies
 RUN yarn install
 
-# use node alpine as base image
-FROM node:18.15.0-alpine3.17 as builder
+# build only with the platform of the host machine, since we just need its files
+FROM --platform=$BUILDPLATFORM node:18.15.0-alpine3.17 AS builder
 # copy the dependencies (node_modules) from the deps image
 COPY --from=deps /app /app
 WORKDIR /app
@@ -26,7 +27,7 @@ RUN yarn build
 
 FROM node:18.15.0-alpine3.17 AS prod-deps
 WORKDIR /app
-# copy necessary for install dependencies
+# copy necessary files for install dependencies
 COPY package.json yarn.lock .yarnrc.yml ./
 # config yarn to install only prod dependencies
 RUN yarn set version berry
@@ -34,7 +35,7 @@ RUN yarn plugin import workspace-tools
 # install prod dependencies
 RUN yarn workspaces focus --all --production
 
-FROM node:18.15.0-alpine3.17 as runner
+FROM node:18.15.0-alpine3.17 AS runner
 # copy the compiled files from the builder image
 COPY --from=builder /app/dist /app/dist
 # copy the prod dependencies (node_modules) from the prod-deps image